In the Log format field, optionally type an Apache-style string or VCL variables to use for log formatting. The Apache Common Log format string appears in this field by default. See our guidance on format strings for more information.

In the Syslog address field, type the domain name or IP address and port to which logs should be sent. Be sure this port can receive incoming TCP traffic from Fastly. See the firewall considerations section for more information.

In the Token field, optionally type a string prefix (line prefix) to send in front of each log line.

From the TLS menu, select No to disable encryption for the syslog endpoint, or Yes to enable it. When you select Yes, the TLS Hostname and TLS CA Certificate fields both appear.

In the TLS Hostname field, optionally type the hostname used to verify the syslog server's certificate. This can be either the Common Name (CN) or Subject Alternate Name (SAN). This field only appears when you select Yes from the Use TLS menu.

In the TLS CA certificate field, optionally copy and paste the Certificate Authority (CA) certificate used to verify that the origin server's certificate is valid. The certificate you upload must be in PEM format. Consider uploading the certificate if it's not signed by a well-known certificate authority. This value is not required if your TLS certificate is signed by a well-known authority. This field only appears when you select Yes from the Use TLS menu.

Click the Advanced options link of the Create a Syslog endpoint page and decide which of the optional fields to change, if any.

Fill out the Advanced options of the Create a Syslog endpoint page as follows:

In the Select a log line format area, select the log line format for your log messages. Our guide on changing log line formats provides more information.

Click the Create button to create the new logging endpoint.

Click the Activate button to deploy your configuration changes.

Adding separators or static strings

To insert a separator or other arbitrary string into the syslog endpoint format:

Syslog facility and severity

The syslog output includes the following facility and severity values:

facility:local0severity:info

Firewall considerations

Syslog has limited security features. For this reason, it's best to create a firewall for your syslog server and only accept TCP traffic on your configured port from our address blocks. Our list of address blocks is dynamic, so we recommend programmatically obtaining the list from our JSON feed whenever possible.